@aauth/proxy 0.1.3

package/dist/registry.js

@@ -0,0 +1,60 @@
+// Registry client: signed GET registry.aauth.dev/resources with ETag cache.
+//
+// The registry is an AAuth resource itself (access_mode: agent-token), so
+// listing requires the agent proxy's agent token + HTTP signature — the same path used
+// for any other agent-token resource. The ETag cache is injected via
+// RegistryCache; the stdio server uses the filesystem default
+// (createFsRegistryCache), backed by ~/.aauth/proxy/catalog/registry.json.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fetch as signedFetch } from '@hellocoop/httpsig';
+export function registryUrl() {
+    return (process.env.PROXY_REGISTRY_URL ?? 'https://registry.aauth.dev').replace(/\/+$/, '');
+}
+// Filesystem-backed RegistryCache — the default for the stdio server. `dir`
+// overrides the state directory (default ~/.aauth/proxy).
+export function createFsRegistryCache(opts = {}) {
+    const cachePath = join(opts.dir ?? join(homedir(), '.aauth', 'proxy'), 'catalog', 'registry.json');
+    return {
+        async read() {
+            if (!existsSync(cachePath))
+                return undefined;
+            try {
+                return JSON.parse(readFileSync(cachePath, 'utf8'));
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async write(c) {
+            mkdirSync(dirname(cachePath), { recursive: true });
+            writeFileSync(cachePath, JSON.stringify(c, null, 2));
+        },
+    };
+}
+// Fetch the registry's /resources, signed with the agent token. Honors
+// If-None-Match against the cached ETag — on 304 returns the cached index;
+// on 200 updates the cache.
+export async function fetchRegistry(cfg, cache) {
+    const url = `${registryUrl()}/resources`;
+    const cached = await cache.read();
+    const headers = { accept: 'application/json' };
+    if (cached?.etag)
+        headers['if-none-match'] = cached.etag;
+    const res = await signedFetch(url, {
+        method: 'GET',
+        headers,
+        signingKey: cfg.agentPrivateJwk,
+        signatureKey: { type: 'jwt', jwt: cfg.agentToken },
+    });
+    if (res.status === 304 && cached)
+        return cached.index;
+    if (!res.ok)
+        throw new Error(`registry ${url}: ${res.status}`);
+    const index = (await res.json());
+    const etag = res.headers.get('etag') ?? undefined;
+    await cache.write({ ...(etag ? { etag } : {}), fetched: new Date().toISOString(), index });
+    return index;
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,uFAAuF;AACvF,qEAAqE;AACrE,8DAA8D;AAC9D,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAgCzD,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,4BAA4B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB,CAAC,OAAyB,EAAE;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IAClG,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC5C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAgB,CAAA;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACX,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAClD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACtD,CAAC;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,2EAA2E;AAC3E,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB,EAAE,KAAoB;IACxE,MAAM,GAAG,GAAG,GAAG,WAAW,EAAE,YAAY,CAAA;IACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACtE,IAAI,MAAM,EAAE,IAAI;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAExD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,KAAK;QACb,OAAO;QACP,UAAU,EAAE,GAAG,CAAC,eAAe;QAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE;KACnD,CAAC,CAAA;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9D,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAA;IACjD,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/resource.d.ts

@@ -0,0 +1,38 @@
+import type { AccessMode, L1Entry } from './store.js';
+import type { InvocationPlan, InvokeArgs, OpDetail, OpSummary, VocabAdapter } from './vocab/index.js';
+export interface AAuthResourceMeta {
+    issuer: string;
+    client_name?: string;
+    description?: string;
+    access_mode?: AccessMode;
+    logo_uri?: string;
+    authorization_endpoint?: string;
+    r3_vocabularies?: Record<string, string>;
+    jwks_uri?: string;
+}
+export interface PickedVocab {
+    vocabUri: string;
+    docUrl: string;
+    adapter: VocabAdapter;
+}
+export interface FetchedResource {
+    host: string;
+    origin: string;
+    meta: AAuthResourceMeta;
+    pickedVocabs: PickedVocab[];
+}
+export declare function fetchResource(hostOrUrl: string): Promise<FetchedResource>;
+export interface DocCache {
+    get(key: string): Promise<unknown | undefined>;
+    set(key: string, doc: unknown): Promise<void>;
+}
+export declare function createMemoryDocCache(): DocCache;
+export declare function listOperationsForResource(l1: L1Entry, query?: string, docCache?: DocCache): Promise<OpSummary[]>;
+export declare function getOperationsForResource(l1: L1Entry, opIds: string[], docCache?: DocCache): Promise<OpDetail[]>;
+export interface RoutedOperation {
+    adapter: VocabAdapter;
+    plan: InvocationPlan;
+}
+export declare function routeOperation(l1: L1Entry, opId: string, args: InvokeArgs, docCache?: DocCache): Promise<RoutedOperation>;
+export declare function toL1Entry(r: FetchedResource): L1Entry;
+//# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,YAAY,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,iBAAiB,CAAA;IACvB,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwB/E;AAuCD,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED,wBAAgB,oBAAoB,IAAI,QAAQ,CAU/C;AA+BD,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,OAAO,EACX,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,SAAS,EAAE,CAAC,CAStB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,QAAQ,EAAE,CAAC,CASrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,CAAA;IACrB,IAAI,EAAE,cAAc,CAAA;CACrB;AAMD,wBAAsB,cAAc,CAClC,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,eAAe,CAAC,CAW1B;AAQD,wBAAgB,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAiBrD"}

package/dist/resource.js

@@ -0,0 +1,159 @@
+// Fetch + validate a resource's well-known doc; pick vocabulary adapters
+// the agent proxy supports. The caller (add_resource) decides what to do with the
+// FetchedResource — typically convert to an L1Entry and store.
+//
+// Mirrors registry/validate.ts:fetchResourceMetadata in spirit: manual
+// redirect, basic shape validation, issuer === origin anti-spoof. The SSRF
+// guards the registry applies (no localhost, no IPs, no non-default ports)
+// are not enforced here because the agent proxy runs on the user's machine, and the
+// user explicitly typed the host they want to add.
+import { canonicalizeHost } from './host.js';
+import { getAdapter, supportedVocabUris } from './vocab/index.js';
+export async function fetchResource(hostOrUrl) {
+    const canonical = canonicalizeHost(hostOrUrl);
+    if (!canonical)
+        throw new Error(`invalid host: ${hostOrUrl}`);
+    const { host, origin } = canonical;
+    const url = `${origin}/.well-known/aauth-resource.json`;
+    const res = await fetch(url, {
+        redirect: 'manual',
+        headers: { accept: 'application/json' },
+    });
+    if (res.status >= 300 && res.status < 400) {
+        throw new Error(`resource ${host}: unexpected redirect`);
+    }
+    if (!res.ok)
+        throw new Error(`resource ${host}: well-known ${res.status}`);
+    const meta = (await res.json());
+    validate(meta, host, origin);
+    return {
+        host,
+        origin,
+        meta,
+        pickedVocabs: pickVocabs(meta.r3_vocabularies ?? {}),
+    };
+}
+function validate(meta, host, origin) {
+    if (!meta.issuer)
+        throw new Error(`resource ${host}: missing issuer`);
+    if (meta.issuer.replace(/\/+$/, '') !== origin) {
+        throw new Error(`resource ${host}: issuer mismatch (got ${meta.issuer}, expected ${origin})`);
+    }
+    if (meta.access_mode !== undefined &&
+        !['agent-token', 'aauth-access-token', 'auth-token'].includes(meta.access_mode)) {
+        throw new Error(`resource ${host}: invalid access_mode ${meta.access_mode}`);
+    }
+    // description is enforced at the registry on submit; agent-proxy-side is lenient
+    // so direct-URL adds of resources without a description still work.
+}
+function pickVocabs(advertised) {
+    const out = [];
+    for (const uri of supportedVocabUris()) {
+        const docUrl = advertised[uri];
+        if (!docUrl)
+            continue;
+        const adapter = getAdapter(uri);
+        if (!adapter)
+            continue;
+        out.push({ vocabUri: uri, docUrl, adapter });
+    }
+    return out;
+}
+export function createMemoryDocCache() {
+    const m = new Map();
+    return {
+        async get(key) {
+            return m.get(key);
+        },
+        async set(key, doc) {
+            m.set(key, doc);
+        },
+    };
+}
+// Process-wide default so callers that don't inject a cache (e.g. agent.ts's
+// invoke path) still share one cache for the process lifetime — unchanged
+// behavior from the previous module-level Map.
+const defaultDocCache = createMemoryDocCache();
+function cacheKey(host, vocabUri) {
+    return `${host}|${vocabUri}`;
+}
+async function loadDoc(host, vocab, cache) {
+    const key = cacheKey(host, vocab.vocabUri);
+    let doc = await cache.get(key);
+    if (doc === undefined) {
+        doc = await vocab.adapter.load(vocab.docUrl);
+        await cache.set(key, doc);
+    }
+    return doc;
+}
+function rehydrate(picked) {
+    const out = [];
+    for (const v of picked) {
+        const adapter = getAdapter(v.vocabUri);
+        if (!adapter)
+            continue;
+        out.push({ vocabUri: v.vocabUri, docUrl: v.docUrl, adapter });
+    }
+    return out;
+}
+export async function listOperationsForResource(l1, query, docCache = defaultDocCache) {
+    const out = [];
+    for (const v of rehydrate(l1.picked_vocabs)) {
+        const doc = await loadDoc(l1.resource, v, docCache);
+        for (const summary of v.adapter.listOperations(doc, query)) {
+            out.push(summary);
+        }
+    }
+    return out;
+}
+export async function getOperationsForResource(l1, opIds, docCache = defaultDocCache) {
+    const out = [];
+    for (const v of rehydrate(l1.picked_vocabs)) {
+        const doc = await loadDoc(l1.resource, v, docCache);
+        for (const detail of v.adapter.getOperations(doc, opIds)) {
+            out.push(detail);
+        }
+    }
+    return out;
+}
+// Resolve an opId on a resource by trying each picked vocab in order. First
+// adapter that builds a plan wins. v1 has a single adapter (OpenAPI), so
+// "first wins" is unambiguous; the collision-prefix rule for multi-adapter
+// resources is an agent-proxy-side concern at list time, not invoke time.
+export async function routeOperation(l1, opId, args, docCache = defaultDocCache) {
+    for (const v of rehydrate(l1.picked_vocabs)) {
+        const doc = await loadDoc(l1.resource, v, docCache);
+        try {
+            const plan = v.adapter.buildInvocation(doc, opId, args);
+            return { adapter: v.adapter, plan };
+        }
+        catch {
+            // try the next adapter
+        }
+    }
+    throw new Error(`unknown operation ${opId} on resource ${l1.resource}`);
+}
+// Convert a FetchedResource into the persisted L1 shape.
+//
+// access_mode default: if the resource advertises an authorization_endpoint
+// but no access_mode, infer aauth-access-token (the R3 flow is the only thing
+// authorization_endpoint exists for). Absent both, default to agent-token
+// (resource accepts agent-signed requests directly — the registry's own mode).
+export function toL1Entry(r) {
+    const inferredMode = r.meta.access_mode ?? (r.meta.authorization_endpoint ? 'aauth-access-token' : 'agent-token');
+    return {
+        resource: r.host,
+        origin: r.origin,
+        issuer: r.meta.issuer.replace(/\/+$/, ''),
+        name: r.meta.client_name?.trim() || r.host,
+        description: r.meta.description ?? '',
+        access_mode: inferredMode,
+        ...(r.meta.logo_uri ? { logo_uri: r.meta.logo_uri } : {}),
+        ...(r.meta.authorization_endpoint
+            ? { authorization_endpoint: r.meta.authorization_endpoint }
+            : {}),
+        picked_vocabs: r.pickedVocabs.map((v) => ({ vocabUri: v.vocabUri, docUrl: v.docUrl })),
+        added: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,oFAAoF;AACpF,mDAAmD;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAkCjE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,MAAM,GAAG,GAAG,GAAG,MAAM,kCAAkC,CAAA;IAEvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAE1E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAA;IACpD,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAE5B,OAAO;QACL,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAAY,EAAE,MAAc;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,IAAI,CAAC,MAAM,cAAc,MAAM,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAC/E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yBAAyB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,iFAAiF;IACjF,oEAAoE;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,UAAkC;IACpD,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAiBD,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAmB,CAAA;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG;YAChB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,+CAA+C;AAC/C,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAA;AAE9C,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,OAAO,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAkB,EAAE,KAAe;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAW,EACX,KAAc,EACd,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAW,EACX,KAAe,EACf,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAW,EACX,IAAY,EACZ,IAAgB,EAChB,WAAqB,eAAe;IAEpC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,gBAAgB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAkB;IAC1C,MAAM,YAAY,GAChB,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAC9F,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI;QAC1C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,YAAY;QACzB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB;YAC/B,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAChC,CAAA;AACH,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":""}

package/dist/server.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// the agent proxy as an MCP stdio server: wires the transport-agnostic eight-tool surface
+// (buildProxyTools) to filesystem-backed state and @aauth/local-keys identity,
+// adds an OS-browser interaction launcher, and connects over stdio. The tool
+// logic itself lives in tools.ts so an HTTP host can reuse it unchanged.
+import { spawn } from 'node:child_process';
+import { createWriteStream, mkdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createLocalKeysIdentityProvider } from './identity-local.js';
+import { createFsRegistryCache } from './registry.js';
+import { createFsL1Store } from './store.js';
+import { buildProxyTools } from './tools.js';
+// Layer 2 of the interaction-driver hierarchy: when the PS couldn't reach the
+// user via its own channels (AAuth#34 interaction_unavailable), the agent proxy runs on
+// the user's machine and can spawn the OS's default-browser launcher. Best
+// effort — silently no-ops on unsupported platforms or when the binary is
+// missing. The text fallback (layer 3) is still emitted by buildProxyTools so a
+// remote MCP or headless caller can surface the URL.
+function tryOpenBrowser(url) {
+    const cmd = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'cmd'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '""', url] : [url];
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // platform / binary missing — text fallback covers it
+    }
+}
+function slugifyClientName(name) {
+    if (!name)
+        return 'mcp-stdio-unknown';
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 32);
+    return slug || 'mcp-stdio-unknown';
+}
+const { version: PKG_VERSION } = createRequire(import.meta.url)('../package.json');
+const server = new McpServer({ name: 'aauth-proxy', version: PKG_VERSION });
+// `--log` tees stdio JSON-RPC frames to ~/.aauth/proxy/logs/<ISO>.jsonl as
+// `{ts, dir, frame}` lines (same shape reloaderoo writes). Opt-in; best-effort —
+// silently no-ops if the log directory can't be created or a line isn't JSON.
+function setupFrameLog() {
+    if (!process.argv.includes('--log'))
+        return;
+    const dir = join(homedir(), '.aauth', 'proxy', 'logs');
+    let stream;
+    try {
+        mkdirSync(dir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-').replace(/-\d{3}Z$/, 'Z');
+        stream = createWriteStream(join(dir, `${stamp}.jsonl`), { flags: 'a' });
+    }
+    catch {
+        return;
+    }
+    const emit = (direction, line) => {
+        const t = line.trim();
+        if (!t)
+            return;
+        try {
+            stream.write(`${JSON.stringify({ ts: new Date().toISOString(), dir: direction, frame: JSON.parse(t) })}\n`);
+        }
+        catch {
+            // Non-JSON output on this transport would be a protocol bug; drop silently.
+        }
+    };
+    // Tee stdout (server->client). Patch before connect so the initialize reply
+    // is captured. Buffer partial lines across writes — the SDK may flush a frame
+    // in multiple chunks.
+    const origWrite = process.stdout.write.bind(process.stdout);
+    let outBuf = '';
+    process.stdout.write = ((chunk, ...rest) => {
+        const text = typeof chunk === 'string'
+            ? chunk
+            : Buffer.isBuffer(chunk)
+                ? chunk.toString('utf8')
+                : String(chunk);
+        outBuf += text;
+        let nl;
+        while ((nl = outBuf.indexOf('\n')) !== -1) {
+            emit('server->client', outBuf.slice(0, nl));
+            outBuf = outBuf.slice(nl + 1);
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return origWrite(chunk, ...rest);
+    });
+    // Tee stdin (client->server). Added as a peer listener — Node fans each data
+    // event out to all listeners, so the SDK still receives every byte.
+    let inBuf = '';
+    process.stdin.on('data', (chunk) => {
+        inBuf += chunk.toString('utf8');
+        let nl;
+        while ((nl = inBuf.indexOf('\n')) !== -1) {
+            emit('client->server', inBuf.slice(0, nl));
+            inBuf = inBuf.slice(nl + 1);
+        }
+    });
+}
+setupFrameLog();
+await buildProxyTools(server, {
+    l1: createFsL1Store(),
+    registryCache: createFsRegistryCache(),
+    identity: createLocalKeysIdentityProvider(),
+    onInteraction: (url, code) => tryOpenBrowser(`${url}?code=${code}`),
+    agentLocal: () => slugifyClientName(server.server.getClientVersion()?.name),
+});
+await server.connect(new StdioServerTransport());
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA,0FAA0F;AAC1F,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AAEzE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,8EAA8E;AAC9E,wFAAwF;AACxF,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAChF,qDAAqD;AACrD,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,UAAU,CAAA;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,mBAAmB,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACf,OAAO,IAAI,IAAI,mBAAmB,CAAA;AACpC,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAwB,CAAA;AACzG,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;AAE3E,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAC9E,SAAS,aAAa;IACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAM;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACtD,IAAI,MAA4C,CAAA;IAChD,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACrF,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,SAA8C,EAAE,IAAY,EAAQ,EAAE;QAClF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,CAAC;YAAE,OAAM;QACd,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CACV,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAC9F,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC,CAAA;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,sBAAsB;IACtB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAW,EAAE;QACtE,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAA;QACd,IAAI,EAAU,CAAA;QACd,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC/B,CAAC;QACD,8DAA8D;QAC9D,OAAQ,SAAiB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3C,CAAC,CAAgC,CAAA;IACjC,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,EAAU,CAAA;QACd,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YAC1C,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,aAAa,EAAE,CAAA;AACf,MAAM,eAAe,CAAC,MAAM,EAAE;IAC5B,EAAE,EAAE,eAAe,EAAE;IACrB,aAAa,EAAE,qBAAqB,EAAE;IACtC,QAAQ,EAAE,+BAA+B,EAAE;IAC3C,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,GAAG,SAAS,IAAI,EAAE,CAAC;IACnE,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC;CAC5E,CAAC,CAAA;AACF,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAA"}

package/dist/store.d.ts

@@ -0,0 +1,28 @@
+export type AccessMode = 'agent-token' | 'aauth-access-token' | 'auth-token';
+export interface L1Entry {
+    resource: string;
+    origin: string;
+    issuer: string;
+    name: string;
+    description: string;
+    access_mode: AccessMode;
+    logo_uri?: string;
+    authorization_endpoint?: string;
+    picked_vocabs: Array<{
+        vocabUri: string;
+        docUrl: string;
+    }>;
+    added: string;
+    last_used?: string;
+}
+export interface L1Store {
+    list(): Promise<L1Entry[]>;
+    get(host: string): Promise<L1Entry | undefined>;
+    upsert(entry: L1Entry): Promise<void>;
+    remove(host: string): Promise<boolean>;
+    touch(host: string): Promise<void>;
+}
+export declare function createFsL1Store(opts?: {
+    dir?: string;
+}): L1Store;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,oBAAoB,GAAG,YAAY,CAAA;AAE5E,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,UAAU,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,aAAa,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD,MAAM,WAAW,OAAO;IACtB,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAQD,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA+CpE"}

package/dist/store.js

@@ -0,0 +1,64 @@
+// L1 — added resources. The L1Store interface lets a host inject its own
+// backend; the stdio server uses the filesystem default (createFsL1Store),
+// backed by ~/.aauth/proxy/resources.json.
+//
+// The agent proxy writes here on add_resource (always), on first successful auth at a
+// resource (touches last_used), and on remove_resource. No PS-side state is
+// mutated by this module; remove is agent-proxy-local only.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+// Filesystem-backed L1Store — the default for the stdio server. `dir` overrides
+// the state directory (default ~/.aauth/proxy).
+export function createFsL1Store(opts = {}) {
+    const stateDir = opts.dir ?? join(homedir(), '.aauth', 'proxy');
+    const l1Path = join(stateDir, 'resources.json');
+    function load() {
+        if (!existsSync(l1Path))
+            return { resources: [] };
+        try {
+            return JSON.parse(readFileSync(l1Path, 'utf8'));
+        }
+        catch {
+            return { resources: [] };
+        }
+    }
+    function save(file) {
+        mkdirSync(dirname(l1Path), { recursive: true });
+        writeFileSync(l1Path, JSON.stringify(file, null, 2));
+    }
+    return {
+        async list() {
+            return load().resources;
+        },
+        async get(host) {
+            return load().resources.find((r) => r.resource === host);
+        },
+        async upsert(entry) {
+            const file = load();
+            const idx = file.resources.findIndex((r) => r.resource === entry.resource);
+            if (idx >= 0)
+                file.resources[idx] = entry;
+            else
+                file.resources.push(entry);
+            save(file);
+        },
+        async remove(host) {
+            const file = load();
+            const next = file.resources.filter((r) => r.resource !== host);
+            if (next.length === file.resources.length)
+                return false;
+            save({ resources: next });
+            return true;
+        },
+        async touch(host) {
+            const file = load();
+            const entry = file.resources.find((r) => r.resource === host);
+            if (!entry)
+                return;
+            entry.last_used = new Date().toISOString();
+            save(file);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,2CAA2C;AAC3C,EAAE;AACF,sFAAsF;AACtF,4EAA4E;AAC5E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAiCzC,gFAAgF;AAChF,gDAAgD;AAChD,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAE/C,SAAS,IAAI;QACX,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,IAAY;QACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,IAAI,EAAE,CAAC,SAAS,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC1E,IAAI,GAAG,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;gBACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAA;YACvD,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,28 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { IdentityProvider } from './identity.js';
+import type { RegistryCache } from './registry.js';
+import type { DocCache } from './resource.js';
+import type { L1Store } from './store.js';
+export interface ProxyDeps {
+    l1: L1Store;
+    registryCache: RegistryCache;
+    identity: IdentityProvider;
+    docCache?: DocCache;
+    onInteraction?: (url: string, code: string) => void;
+    agentLocal?: () => string | undefined;
+    interaction?: {
+        mode?: 'surface' | 'await';
+        onInteraction?: (url: string, code: string, ctx: InteractionContext) => void | Promise<void>;
+        onPoll?: (elapsedMs: number, ctx: InteractionContext) => void | Promise<void>;
+        pollTimeoutMs?: number;
+    };
+}
+export interface InteractionContext {
+    sendNotification: (n: {
+        method: string;
+        params?: Record<string, unknown>;
+    }) => Promise<void>;
+    progressToken?: string | number;
+}
+export declare function buildProxyTools(server: McpServer, deps: ProxyDeps): Promise<void>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAKxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAOlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAA;IACX,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,gBAAgB,CAAA;IAG1B,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAGnB,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAGnD,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IAWrC,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAA;QAC1B,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5F,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7E,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAMD,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5F,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAChC;AAqBD,wBAAsB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyRvF"}